mongodb 5.1.0 → 5.2.0

package/lib/cmap/auth/mongodb_aws.js

@@ -4,6 +4,7 @@ exports.MongoDBAWS = void 0;
 const crypto = require("crypto");
 const http = require("http");
 const url = require("url");
+const util_1 = require("util");
 const BSON = require("../../bson");
 const deps_1 = require("../../deps");
 const error_1 = require("../../error");
@@ -23,28 +24,26 @@ const bsonOptions = {
     bsonRegExp: false
 };
 class MongoDBAWS extends auth_provider_1.AuthProvider {
-    auth(authContext, callback) {
-        const { connection, credentials } = authContext;
-        if (!credentials) {
-            return callback(new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.'));
+    constructor() {
+        super();
+        this.randomBytesAsync = (0, util_1.promisify)(crypto.randomBytes);
+    }
+    async auth(authContext) {
+        const { connection } = authContext;
+        if (!authContext.credentials) {
+            throw new error_1.MongoMissingCredentialsError('AuthContext must provide credentials.');
         }
         if ('kModuleError' in deps_1.aws4) {
-            return callback(deps_1.aws4['kModuleError']);
+            throw deps_1.aws4['kModuleError'];
         }
         const { sign } = deps_1.aws4;
         if ((0, utils_1.maxWireVersion)(connection) < 9) {
-            callback(new error_1.MongoCompatibilityError('MONGODB-AWS authentication requires MongoDB version 4.4 or later'));
-            return;
+            throw new error_1.MongoCompatibilityError('MONGODB-AWS authentication requires MongoDB version 4.4 or later');
         }
-        if (!credentials.username) {
-            makeTempCredentials(credentials, (err, tempCredentials) => {
-                if (err || !tempCredentials)
-                    return callback(err);
-                authContext.credentials = tempCredentials;
-                this.auth(authContext, callback);
-            });
-            return;
+        if (!authContext.credentials.username) {
+            authContext.credentials = await makeTempCredentials(authContext.credentials);
         }
+        const { credentials } = authContext;
         const accessKeyId = credentials.username;
         const secretAccessKey = credentials.password;
         const sessionToken = credentials.mechanismProperties.AWS_SESSION_TOKEN;
@@ -55,80 +54,67 @@ class MongoDBAWS extends auth_provider_1.AuthProvider {
                 ? { accessKeyId, secretAccessKey }
                 : undefined;
         const db = credentials.source;
-        crypto.randomBytes(32, (err, nonce) => {
-            if (err) {
-                callback(err);
-                return;
-            }
-            const saslStart = {
-                saslStart: 1,
-                mechanism: 'MONGODB-AWS',
-                payload: BSON.serialize({ r: nonce, p: ASCII_N }, bsonOptions)
-            };
-            connection.command((0, utils_1.ns)(`${db}.$cmd`), saslStart, undefined, (err, res) => {
-                if (err)
-                    return callback(err);
-                const serverResponse = BSON.deserialize(res.payload.buffer, bsonOptions);
-                const host = serverResponse.h;
-                const serverNonce = serverResponse.s.buffer;
-                if (serverNonce.length !== 64) {
-                    callback(
-                    // TODO(NODE-3483)
-                    new error_1.MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`));
-                    return;
-                }
-                if (!utils_1.ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
-                    // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes
-                    // https://github.com/mongodb/specifications/blob/875446db44aade414011731840831f38a6c668df/source/auth/auth.rst#id11
-                    // TODO(NODE-3483)
-                    callback(new error_1.MongoRuntimeError('Server nonce does not begin with client nonce'));
-                    return;
-                }
-                if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {
-                    // TODO(NODE-3483)
-                    callback(new error_1.MongoRuntimeError(`Server returned an invalid host: "${host}"`));
-                    return;
-                }
-                const body = 'Action=GetCallerIdentity&Version=2011-06-15';
-                const options = sign({
-                    method: 'POST',
-                    host,
-                    region: deriveRegion(serverResponse.h),
-                    service: 'sts',
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded',
-                        'Content-Length': body.length,
-                        'X-MongoDB-Server-Nonce': utils_1.ByteUtils.toBase64(serverNonce),
-                        'X-MongoDB-GS2-CB-Flag': 'n'
-                    },
-                    path: '/',
-                    body
-                }, awsCredentials);
-                const payload = {
-                    a: options.headers.Authorization,
-                    d: options.headers['X-Amz-Date']
-                };
-                if (sessionToken) {
-                    payload.t = sessionToken;
-                }
-                const saslContinue = {
-                    saslContinue: 1,
-                    conversationId: 1,
-                    payload: BSON.serialize(payload, bsonOptions)
-                };
-                connection.command((0, utils_1.ns)(`${db}.$cmd`), saslContinue, undefined, callback);
-            });
-        });
+        const nonce = await this.randomBytesAsync(32);
+        const saslStart = {
+            saslStart: 1,
+            mechanism: 'MONGODB-AWS',
+            payload: BSON.serialize({ r: nonce, p: ASCII_N }, bsonOptions)
+        };
+        const saslStartResponse = await connection.commandAsync((0, utils_1.ns)(`${db}.$cmd`), saslStart, undefined);
+        const serverResponse = BSON.deserialize(saslStartResponse.payload.buffer, bsonOptions);
+        const host = serverResponse.h;
+        const serverNonce = serverResponse.s.buffer;
+        if (serverNonce.length !== 64) {
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError(`Invalid server nonce length ${serverNonce.length}, expected 64`);
+        }
+        if (!utils_1.ByteUtils.equals(serverNonce.subarray(0, nonce.byteLength), nonce)) {
+            // throw because the serverNonce's leading 32 bytes must equal the client nonce's 32 bytes
+            // https://github.com/mongodb/specifications/blob/875446db44aade414011731840831f38a6c668df/source/auth/auth.rst#id11
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError('Server nonce does not begin with client nonce');
+        }
+        if (host.length < 1 || host.length > 255 || host.indexOf('..') !== -1) {
+            // TODO(NODE-3483)
+            throw new error_1.MongoRuntimeError(`Server returned an invalid host: "${host}"`);
+        }
+        const body = 'Action=GetCallerIdentity&Version=2011-06-15';
+        const options = sign({
+            method: 'POST',
+            host,
+            region: deriveRegion(serverResponse.h),
+            service: 'sts',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'Content-Length': body.length,
+                'X-MongoDB-Server-Nonce': utils_1.ByteUtils.toBase64(serverNonce),
+                'X-MongoDB-GS2-CB-Flag': 'n'
+            },
+            path: '/',
+            body
+        }, awsCredentials);
+        const payload = {
+            a: options.headers.Authorization,
+            d: options.headers['X-Amz-Date']
+        };
+        if (sessionToken) {
+            payload.t = sessionToken;
+        }
+        const saslContinue = {
+            saslContinue: 1,
+            conversationId: 1,
+            payload: BSON.serialize(payload, bsonOptions)
+        };
+        await connection.commandAsync((0, utils_1.ns)(`${db}.$cmd`), saslContinue, undefined);
     }
 }
 exports.MongoDBAWS = MongoDBAWS;
-function makeTempCredentials(credentials, callback) {
-    function done(creds) {
+async function makeTempCredentials(credentials) {
+    function makeMongoCredentialsFromAWSTemp(creds) {
         if (!creds.AccessKeyId || !creds.SecretAccessKey || !creds.Token) {
-            callback(new error_1.MongoMissingCredentialsError('Could not obtain temporary MONGODB-AWS credentials'));
-            return;
+            throw new error_1.MongoMissingCredentialsError('Could not obtain temporary MONGODB-AWS credentials');
         }
-        callback(undefined, new mongo_credentials_1.MongoCredentials({
+        return new mongo_credentials_1.MongoCredentials({
             username: creds.AccessKeyId,
             password: creds.SecretAccessKey,
             source: credentials.source,
@@ -136,7 +122,7 @@ function makeTempCredentials(credentials, callback) {
             mechanismProperties: {
                 AWS_SESSION_TOKEN: creds.Token
             }
-        }));
+        });
     }
     const credentialProvider = (0, deps_1.getAwsCredentialProvider)();
     // Check if the AWS credential provider from the SDK is present. If not,
@@ -145,30 +131,25 @@ function makeTempCredentials(credentials, callback) {
         // If the environment variable AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
         // is set then drivers MUST assume that it was set by an AWS ECS agent
         if (process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI) {
-            request(`${AWS_RELATIVE_URI}${process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}`, undefined, (err, res) => {
-                if (err)
-                    return callback(err);
-                done(res);
-            });
-            return;
+            return makeMongoCredentialsFromAWSTemp(await request(`${AWS_RELATIVE_URI}${process.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI}`));
         }
         // Otherwise assume we are on an EC2 instance
         // get a token
-        request(`${AWS_EC2_URI}/latest/api/token`, { method: 'PUT', json: false, headers: { 'X-aws-ec2-metadata-token-ttl-seconds': 30 } }, (err, token) => {
-            if (err)
-                return callback(err);
-            // get role name
-            request(`${AWS_EC2_URI}/${AWS_EC2_PATH}`, { json: false, headers: { 'X-aws-ec2-metadata-token': token } }, (err, roleName) => {
-                if (err)
-                    return callback(err);
-                // get temp credentials
-                request(`${AWS_EC2_URI}/${AWS_EC2_PATH}/${roleName}`, { headers: { 'X-aws-ec2-metadata-token': token } }, (err, creds) => {
-                    if (err)
-                        return callback(err);
-                    done(creds);
-                });
-            });
+        const token = await request(`${AWS_EC2_URI}/latest/api/token`, {
+            method: 'PUT',
+            json: false,
+            headers: { 'X-aws-ec2-metadata-token-ttl-seconds': 30 }
+        });
+        // get role name
+        const roleName = await request(`${AWS_EC2_URI}/${AWS_EC2_PATH}`, {
+            json: false,
+            headers: { 'X-aws-ec2-metadata-token': token }
+        });
+        // get temp credentials
+        const creds = await request(`${AWS_EC2_URI}/${AWS_EC2_PATH}/${roleName}`, {
+            headers: { 'X-aws-ec2-metadata-token': token }
         });
+        return makeMongoCredentialsFromAWSTemp(creds);
     }
     else {
         /*
@@ -183,18 +164,18 @@ function makeTempCredentials(credentials, callback) {
          */
         const { fromNodeProviderChain } = credentialProvider;
         const provider = fromNodeProviderChain();
-        provider()
-            .then((creds) => {
-            done({
+        try {
+            const creds = await provider();
+            return makeMongoCredentialsFromAWSTemp({
                 AccessKeyId: creds.accessKeyId,
                 SecretAccessKey: creds.secretAccessKey,
                 Token: creds.sessionToken,
                 Expiration: creds.expiration
             });
-        })
-            .catch((error) => {
-            callback(new error_1.MongoAWSError(error.message));
-        });
+        }
+        catch (error) {
+            throw new error_1.MongoAWSError(error.message);
+        }
     }
 }
 function deriveRegion(host) {
@@ -204,35 +185,39 @@ function deriveRegion(host) {
     }
     return parts[1];
 }
-function request(uri, _options, callback) {
-    const options = Object.assign({
-        method: 'GET',
-        timeout: 10000,
-        json: true
-    }, url.parse(uri), _options);
-    const req = http.request(options, res => {
-        res.setEncoding('utf8');
-        let data = '';
-        res.on('data', d => (data += d));
-        res.on('end', () => {
-            if (options.json === false) {
-                callback(undefined, data);
-                return;
-            }
-            try {
-                const parsed = JSON.parse(data);
-                callback(undefined, parsed);
-            }
-            catch (err) {
-                // TODO(NODE-3483)
-                callback(new error_1.MongoRuntimeError(`Invalid JSON response: "${data}"`));
-            }
+async function request(uri, options = {}) {
+    return new Promise((resolve, reject) => {
+        const requestOptions = {
+            method: 'GET',
+            timeout: 10000,
+            json: true,
+            ...url.parse(uri),
+            ...options
+        };
+        const req = http.request(requestOptions, res => {
+            res.setEncoding('utf8');
+            let data = '';
+            res.on('data', d => {
+                data += d;
+            });
+            res.once('end', () => {
+                if (options.json === false) {
+                    resolve(data);
+                    return;
+                }
+                try {
+                    const parsed = JSON.parse(data);
+                    resolve(parsed);
+                }
+                catch {
+                    // TODO(NODE-3483)
+                    reject(new error_1.MongoRuntimeError(`Invalid JSON response: "${data}"`));
+                }
+            });
         });
+        req.once('timeout', () => req.destroy(new error_1.MongoAWSError(`AWS request to ${uri} timed out after ${options.timeout} ms`)));
+        req.once('error', error => reject(error));
+        req.end();
     });
-    req.on('timeout', () => {
-        req.destroy(new error_1.MongoAWSError(`AWS request to ${uri} timed out after ${options.timeout} ms`));
-    });
-    req.on('error', err => callback(err));
-    req.end();
 }
 //# sourceMappingURL=mongodb_aws.js.map

package/lib/cmap/auth/mongodb_aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"mongodb_aws.js","sourceRoot":"","sources":["../../../src/cmap/auth/mongodb_aws.ts"],"names":[],"mappings":";;;AAAA,iCAAiC;AACjC,6BAA6B;AAC7B,2BAA2B;AAG3B,mCAAmC;AACnC,qCAA4D;AAC5D,uCAKqB;AACrB,uCAAsE;AACtE,mDAA4D;AAC5D,2DAAuD;AACvD,2CAA4C;AAE5C,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAClE,MAAM,WAAW,GAAyB;IACxC,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,KAAK;CAClB,CAAC;AAQF,MAAa,UAAW,SAAQ,4BAAY;IACjC,IAAI,CAAC,WAAwB,EAAE,QAAkB;QACxD,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;QAChD,IAAI,CAAC,WAAW,EAAE;YAChB,OAAO,QAAQ,CAAC,IAAI,oCAA4B,CAAC,uCAAuC,CAAC,CAAC,CAAC;SAC5F;QAED,IAAI,cAAc,IAAI,WAAI,EAAE;YAC1B,OAAO,QAAQ,CAAC,WAAI,CAAC,cAAc,CAAC,CAAC,CAAC;SACvC;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAI,CAAC;QAEtB,IAAI,IAAA,sBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,EAAE;YAClC,QAAQ,CACN,IAAI,+BAAuB,CACzB,kEAAkE,CACnE,CACF,CAAC;YACF,OAAO;SACR;QAED,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE;YACzB,mBAAmB,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,EAAE;gBACxD,IAAI,GAAG,IAAI,CAAC,eAAe;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAElD,WAAW,CAAC,WAAW,GAAG,eAAe,CAAC;gBAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YAEH,OAAO;SACR;QAED,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC;QACzC,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC;QAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;QAEvE,kGAAkG;QAClG,MAAM,cAAc,GAClB,WAAW,IAAI,eAAe,IAAI,YAAY;YAC5C,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE;YAChD,CAAC,CAAC,WAAW,IAAI,eAAe;gBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE;gBAClC,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACpC,IAAI,GAAG,EAAE;gBACP,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO;aACR;YAED,MAAM,SAAS,GAAG;gBAChB,SAAS,EAAE,CAAC;gBACZ,SAAS,EAAE,aAAa;gBACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC;aAC/D,CAAC;YAEF,UAAU,CAAC,OAAO,CAAC,IAAA,UAAE,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACtE,IAAI,GAAG;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAE9B,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAGtE,CAAC;gBACF,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC;gBAC9B,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE;oBAC7B,QAAQ;oBACN,kBAAkB;oBAClB,IAAI,yBAAiB,CAAC,+BAA+B,WAAW,CAAC,MAAM,eAAe,CAAC,CACxF,CAAC;oBAEF,OAAO;iBACR;gBAED,IAAI,CAAC,iBAAS,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,EAAE;oBACvE,0FAA0F;oBAC1F,oHAAoH;oBAEpH,kBAAkB;oBAClB,QAAQ,CAAC,IAAI,yBAAiB,CAAC,+CAA+C,CAAC,CAAC,CAAC;oBACjF,OAAO;iBACR;gBAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE;oBACrE,kBAAkB;oBAClB,QAAQ,CAAC,IAAI,yBAAiB,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC,CAAC;oBAC9E,OAAO;iBACR;gBAED,MAAM,IAAI,GAAG,6CAA6C,CAAC;gBAC3D,MAAM,OAAO,GAAG,IAAI,CAClB;oBACE,MAAM,EAAE,MAAM;oBACd,IAAI;oBACJ,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;oBACtC,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,gBAAgB,EAAE,IAAI,CAAC,MAAM;wBAC7B,wBAAwB,EAAE,iBAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;wBACzD,uBAAuB,EAAE,GAAG;qBAC7B;oBACD,IAAI,EAAE,GAAG;oBACT,IAAI;iBACL,EACD,cAAc,CACf,CAAC;gBAEF,MAAM,OAAO,GAA2B;oBACtC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;oBAChC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;iBACjC,CAAC;gBACF,IAAI,YAAY,EAAE;oBAChB,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC;iBAC1B;gBAED,MAAM,YAAY,GAAG;oBACnB,YAAY,EAAE,CAAC;oBACf,cAAc,EAAE,CAAC;oBACjB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;iBAC9C,CAAC;gBAEF,UAAU,CAAC,OAAO,CAAC,IAAA,UAAE,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA/HD,gCA+HC;AAkBD,SAAS,mBAAmB,CAAC,WAA6B,EAAE,QAAoC;IAC9F,SAAS,IAAI,CAAC,KAAyB;QACrC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YAChE,QAAQ,CACN,IAAI,oCAA4B,CAAC,oDAAoD,CAAC,CACvF,CAAC;YACF,OAAO;SACR;QAED,QAAQ,CACN,SAAS,EACT,IAAI,oCAAgB,CAAC;YACnB,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,yBAAa,CAAC,WAAW;YACpC,mBAAmB,EAAE;gBACnB,iBAAiB,EAAE,KAAK,CAAC,KAAK;aAC/B;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAA,+BAAwB,GAAE,CAAC;IAEtD,wEAAwE;IACxE,sBAAsB;IACtB,IAAI,cAAc,IAAI,kBAAkB,EAAE;QACxC,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE;YACtD,OAAO,CACL,GAAG,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,EAC1E,SAAS,EACT,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACX,IAAI,GAAG;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,CACF,CAAC;YAEF,OAAO;SACR;QAED,6CAA6C;QAE7C,cAAc;QACd,OAAO,CACL,GAAG,WAAW,mBAAmB,EACjC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,sCAAsC,EAAE,EAAE,EAAE,EAAE,EACvF,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACb,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;YAE9B,gBAAgB;YAChB,OAAO,CACL,GAAG,WAAW,IAAI,YAAY,EAAE,EAChC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,EAC/D,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;gBAChB,IAAI,GAAG;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAE9B,uBAAuB;gBACvB,OAAO,CACL,GAAG,WAAW,IAAI,YAAY,IAAI,QAAQ,EAAE,EAC5C,EAAE,OAAO,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,EAClD,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBACb,IAAI,GAAG;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,CAAC,KAAK,CAAC,CAAC;gBACd,CAAC,CACF,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC,CACF,CAAC;KACH;SAAM;QACL;;;;;;;;;WASG;QACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,kBAAkB,CAAC;QACrD,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;QACzC,QAAQ,EAAE;aACP,IAAI,CAAC,CAAC,KAAqB,EAAE,EAAE;YAC9B,IAAI,CAAC;gBACH,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,KAAK,EAAE,KAAK,CAAC,YAAY;gBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;YACtB,QAAQ,CAAC,IAAI,qBAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;KACN;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE;QAClD,OAAO,WAAW,CAAC;KACpB;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AASD,SAAS,OAAO,CAAC,GAAW,EAAE,QAAoC,EAAE,QAAkB;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,IAAI;KACX,EACD,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EACd,QAAQ,CACT,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAExB,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE;gBAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;gBAC1B,OAAO;aACR;YAED,IAAI;gBACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;aAC7B;YAAC,OAAO,GAAG,EAAE;gBACZ,kBAAkB;gBAClB,QAAQ,CAAC,IAAI,yBAAiB,CAAC,2BAA2B,IAAI,GAAG,CAAC,CAAC,CAAC;aACrE;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACrB,GAAG,CAAC,OAAO,CAAC,IAAI,qBAAa,CAAC,kBAAkB,GAAG,oBAAoB,OAAO,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC;IAChG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"mongodb_aws.js","sourceRoot":"","sources":["../../../src/cmap/auth/mongodb_aws.ts"],"names":[],"mappings":";;;AAAA,iCAAiC;AACjC,6BAA6B;AAC7B,2BAA2B;AAC3B,+BAAiC;AAGjC,mCAAmC;AACnC,qCAA4D;AAC5D,uCAKqB;AACrB,uCAA4D;AAC5D,mDAA4D;AAC5D,2DAAuD;AACvD,2CAA4C;AAE5C,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAChD,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAClE,MAAM,WAAW,GAAyB;IACxC,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,KAAK;IACrB,UAAU,EAAE,KAAK;CAClB,CAAC;AAQF,MAAa,UAAW,SAAQ,4BAAY;IAG1C;QACE,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,gBAAgB,GAAG,IAAA,gBAAS,EAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC;IAEQ,KAAK,CAAC,IAAI,CAAC,WAAwB;QAC1C,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;YAC5B,MAAM,IAAI,oCAA4B,CAAC,uCAAuC,CAAC,CAAC;SACjF;QAED,IAAI,cAAc,IAAI,WAAI,EAAE;YAC1B,MAAM,WAAI,CAAC,cAAc,CAAC,CAAC;SAC5B;QACD,MAAM,EAAE,IAAI,EAAE,GAAG,WAAI,CAAC;QAEtB,IAAI,IAAA,sBAAc,EAAC,UAAU,CAAC,GAAG,CAAC,EAAE;YAClC,MAAM,IAAI,+BAAuB,CAC/B,kEAAkE,CACnE,CAAC;SACH;QAED,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,EAAE;YACrC,WAAW,CAAC,WAAW,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;SAC9E;QAED,MAAM,EAAE,WAAW,EAAE,GAAG,WAAW,CAAC;QAEpC,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC;QACzC,MAAM,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC;QAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;QAEvE,kGAAkG;QAClG,MAAM,cAAc,GAClB,WAAW,IAAI,eAAe,IAAI,YAAY;YAC5C,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE;YAChD,CAAC,CAAC,WAAW,IAAI,eAAe;gBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE;gBAClC,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAE9C,MAAM,SAAS,GAAG;YAChB,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,aAAa;YACxB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC;SAC/D,CAAC;QAEF,MAAM,iBAAiB,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,IAAA,UAAE,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAEhG,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAGpF,CAAC;QACF,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC;QAC9B,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE;YAC7B,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,+BAA+B,WAAW,CAAC,MAAM,eAAe,CAAC,CAAC;SAC/F;QAED,IAAI,CAAC,iBAAS,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,EAAE;YACvE,0FAA0F;YAC1F,oHAAoH;YAEpH,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,+CAA+C,CAAC,CAAC;SAC9E;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE;YACrE,kBAAkB;YAClB,MAAM,IAAI,yBAAiB,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;SAC3E;QAED,MAAM,IAAI,GAAG,6CAA6C,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAClB;YACE,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;YACtC,OAAO,EAAE,KAAK;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,gBAAgB,EAAE,IAAI,CAAC,MAAM;gBAC7B,wBAAwB,EAAE,iBAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACzD,uBAAuB,EAAE,GAAG;aAC7B;YACD,IAAI,EAAE,GAAG;YACT,IAAI;SACL,EACD,cAAc,CACf,CAAC;QAEF,MAAM,OAAO,GAA2B;YACtC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa;YAChC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;SACjC,CAAC;QAEF,IAAI,YAAY,EAAE;YAChB,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC;SAC1B;QAED,MAAM,YAAY,GAAG;YACnB,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC;SAC9C,CAAC;QAEF,MAAM,UAAU,CAAC,YAAY,CAAC,IAAA,UAAE,EAAC,GAAG,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;CACF;AAlHD,gCAkHC;AAkBD,KAAK,UAAU,mBAAmB,CAAC,WAA6B;IAC9D,SAAS,+BAA+B,CAAC,KAAyB;QAChE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YAChE,MAAM,IAAI,oCAA4B,CAAC,oDAAoD,CAAC,CAAC;SAC9F;QAED,OAAO,IAAI,oCAAgB,CAAC;YAC1B,QAAQ,EAAE,KAAK,CAAC,WAAW;YAC3B,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,yBAAa,CAAC,WAAW;YACpC,mBAAmB,EAAE;gBACnB,iBAAiB,EAAE,KAAK,CAAC,KAAK;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAA,+BAAwB,GAAE,CAAC;IAEtD,wEAAwE;IACxE,sBAAsB;IACtB,IAAI,cAAc,IAAI,kBAAkB,EAAE;QACxC,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE;YACtD,OAAO,+BAA+B,CACpC,MAAM,OAAO,CAAC,GAAG,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,EAAE,CAAC,CAC1F,CAAC;SACH;QAED,6CAA6C;QAE7C,cAAc;QACd,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,WAAW,mBAAmB,EAAE;YAC7D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,EAAE,sCAAsC,EAAE,EAAE,EAAE;SACxD,CAAC,CAAC;QAEH,gBAAgB;QAChB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,WAAW,IAAI,YAAY,EAAE,EAAE;YAC/D,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE;SAC/C,CAAC,CAAC;QAEH,uBAAuB;QACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,WAAW,IAAI,YAAY,IAAI,QAAQ,EAAE,EAAE;YACxE,OAAO,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE;SAC/C,CAAC,CAAC;QAEH,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;KAC/C;SAAM;QACL;;;;;;;;;WASG;QACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,kBAAkB,CAAC;QACrD,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;QACzC,IAAI;YACF,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC/B,OAAO,+BAA+B,CAAC;gBACrC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,KAAK,EAAE,KAAK,CAAC,YAAY;gBACzB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;SACJ;QAAC,OAAO,KAAK,EAAE;YACd,MAAM,IAAI,qBAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SACxC;KACF;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE;QAClD,OAAO,WAAW,CAAC;KACpB;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAeD,KAAK,UAAU,OAAO,CACpB,GAAW,EACX,UAA0B,EAAE;IAE5B,OAAO,IAAI,OAAO,CAA+B,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnE,MAAM,cAAc,GAAG;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,IAAI;YACV,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACjB,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE;YAC7C,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAExB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;gBACjB,IAAI,IAAI,CAAC,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE;gBACnB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE;oBAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;oBACd,OAAO;iBACR;gBAED,IAAI;oBACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAChC,OAAO,CAAC,MAAM,CAAC,CAAC;iBACjB;gBAAC,MAAM;oBACN,kBAAkB;oBAClB,MAAM,CAAC,IAAI,yBAAiB,CAAC,2BAA2B,IAAI,GAAG,CAAC,CAAC,CAAC;iBACnE;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CACvB,GAAG,CAAC,OAAO,CAAC,IAAI,qBAAa,CAAC,kBAAkB,GAAG,oBAAoB,OAAO,CAAC,OAAO,KAAK,CAAC,CAAC,CAC9F,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/cmap/auth/mongodb_oidc/aws_service_workflow.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsServiceWorkflow = void 0;
+const promises_1 = require("fs/promises");
+const error_1 = require("../../../error");
+const service_workflow_1 = require("./service_workflow");
+/**
+ * Device workflow implementation for AWS.
+ *
+ * @internal
+ */
+class AwsServiceWorkflow extends service_workflow_1.ServiceWorkflow {
+    constructor() {
+        super();
+    }
+    /**
+     * Get the token from the environment.
+     */
+    async getToken() {
+        const tokenFile = process.env.AWS_WEB_IDENTITY_TOKEN_FILE;
+        if (!tokenFile) {
+            throw new error_1.MongoAWSError('AWS_WEB_IDENTITY_TOKEN_FILE must be set in the environment.');
+        }
+        return (0, promises_1.readFile)(tokenFile, 'utf8');
+    }
+}
+exports.AwsServiceWorkflow = AwsServiceWorkflow;
+//# sourceMappingURL=aws_service_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/aws_service_workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws_service_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/aws_service_workflow.ts"],"names":[],"mappings":";;;AAAA,0CAAuC;AAEvC,0CAA+C;AAC/C,yDAAqD;AAErD;;;;GAIG;AACH,MAAa,kBAAmB,SAAQ,kCAAe;IACrD;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE;YACd,MAAM,IAAI,qBAAa,CAAC,6DAA6D,CAAC,CAAC;SACxF;QACD,OAAO,IAAA,mBAAQ,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;CACF;AAfD,gDAeC"}

package/lib/cmap/auth/mongodb_oidc/callback_workflow.js

@@ -0,0 +1,178 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallbackWorkflow = void 0;
+const bson_1 = require("bson");
+const error_1 = require("../../../error");
+const utils_1 = require("../../../utils");
+const providers_1 = require("../providers");
+const token_entry_cache_1 = require("./token_entry_cache");
+/* 5 minutes in milliseconds */
+const TIMEOUT_MS = 300000;
+/**
+ * OIDC implementation of a callback based workflow.
+ * @internal
+ */
+class CallbackWorkflow {
+    /**
+     * Instantiate the workflow
+     */
+    constructor() {
+        this.cache = new token_entry_cache_1.TokenEntryCache();
+    }
+    /**
+     * Get the document to add for speculative authentication. Is empty when
+     * callbacks are in play.
+     */
+    speculativeAuth() {
+        return Promise.resolve({});
+    }
+    /**
+     * Execute the workflow.
+     *
+     * Steps:
+     * - If an entry is in the cache
+     *   - If it is not expired
+     *     - Skip step one and use the entry to execute step two.
+     *   - If it is expired
+     *     - If the refresh callback exists
+     *       - remove expired entry from cache
+     *       - call the refresh callback.
+     *       - put the new entry in the cache.
+     *       - execute step two.
+     *     - If the refresh callback does not exist.
+     *       - remove expired entry from cache
+     *       - call the request callback.
+     *       - put the new entry in the cache.
+     *       - execute step two.
+     * - If no entry is in the cache.
+     *   - execute step one.
+     *   - call the refresh callback.
+     *   - put the new entry in the cache.
+     *   - execute step two.
+     */
+    async execute(connection, credentials, reauthenticate = false) {
+        const request = credentials.mechanismProperties.REQUEST_TOKEN_CALLBACK;
+        const refresh = credentials.mechanismProperties.REFRESH_TOKEN_CALLBACK;
+        const entry = this.cache.getEntry(connection.address, credentials.username, request || null, refresh || null);
+        if (entry) {
+            // Check if the entry is not expired and if we are reauthenticating.
+            if (!reauthenticate && entry.isValid()) {
+                // Skip step one and execute the step two saslContinue.
+                try {
+                    const result = await finishAuth(entry.tokenResult, undefined, connection, credentials);
+                    return result;
+                }
+                catch (error) {
+                    // If authentication errors when using a cached token we remove it from
+                    // the cache.
+                    this.cache.deleteEntry(connection.address, credentials.username || '', request || null, refresh || null);
+                    throw error;
+                }
+            }
+            else {
+                // Remove the expired entry from the cache.
+                this.cache.deleteEntry(connection.address, credentials.username || '', request || null, refresh || null);
+                // Execute a refresh of the token and finish auth.
+                return this.refreshAndFinish(connection, credentials, entry.serverResult, entry.tokenResult);
+            }
+        }
+        else {
+            // No entry means to start with the step one saslStart.
+            const result = await connection.commandAsync((0, utils_1.ns)(credentials.source), startCommandDocument(credentials), undefined);
+            const stepOne = bson_1.BSON.deserialize(result.payload.buffer);
+            // Call the request callback and finish auth.
+            return this.requestAndFinish(connection, credentials, stepOne, result.conversationId);
+        }
+    }
+    /**
+     * Execute the refresh callback if it exists, otherwise the request callback, then
+     * finish the authentication.
+     */
+    async refreshAndFinish(connection, credentials, stepOneResult, tokenResult, conversationId) {
+        const request = credentials.mechanismProperties.REQUEST_TOKEN_CALLBACK;
+        const refresh = credentials.mechanismProperties.REFRESH_TOKEN_CALLBACK;
+        // If a refresh callback exists, use it. Otherwise use the request callback.
+        if (refresh) {
+            const result = await refresh(credentials.username, stepOneResult, tokenResult, TIMEOUT_MS);
+            // Validate the result.
+            if (!result || !result.accessToken) {
+                throw new error_1.MongoMissingCredentialsError('REFRESH_TOKEN_CALLBACK must return a valid object with an accessToken');
+            }
+            // Cache a new entry and continue with the saslContinue.
+            this.cache.addEntry(connection.address, credentials.username || '', request || null, refresh, result, stepOneResult);
+            return finishAuth(result, conversationId, connection, credentials);
+        }
+        else {
+            // Fallback to using the request callback.
+            return this.requestAndFinish(connection, credentials, stepOneResult, conversationId);
+        }
+    }
+    /**
+     * Execute the request callback and finish authentication.
+     */
+    async requestAndFinish(connection, credentials, stepOneResult, conversationId) {
+        // Call the request callback.
+        const request = credentials.mechanismProperties.REQUEST_TOKEN_CALLBACK;
+        const refresh = credentials.mechanismProperties.REFRESH_TOKEN_CALLBACK;
+        // Always clear expired entries from the cache on each finish as cleanup.
+        this.cache.deleteExpiredEntries();
+        if (!request) {
+            // Request callback must be present.
+            throw new error_1.MongoInvalidArgumentError('Auth mechanism property REQUEST_TOKEN_CALLBACK is required.');
+        }
+        const tokenResult = await request(credentials.username, stepOneResult, TIMEOUT_MS);
+        // Validate the result.
+        if (!tokenResult || !tokenResult.accessToken) {
+            throw new error_1.MongoMissingCredentialsError('REQUEST_TOKEN_CALLBACK must return a valid object with an accessToken');
+        }
+        // Cache a new entry and continue with the saslContinue.
+        this.cache.addEntry(connection.address, credentials.username || '', request, refresh || null, tokenResult, stepOneResult);
+        return finishAuth(tokenResult, conversationId, connection, credentials);
+    }
+}
+exports.CallbackWorkflow = CallbackWorkflow;
+/**
+ * Cache the result of the user supplied callback and execute the
+ * step two saslContinue.
+ */
+async function finishAuth(result, conversationId, connection, credentials) {
+    // Execute the step two saslContinue.
+    return connection.commandAsync((0, utils_1.ns)(credentials.source), continueCommandDocument(result.accessToken, conversationId), undefined);
+}
+/**
+ * Generate the saslStart command document.
+ */
+function startCommandDocument(credentials) {
+    const payload = {};
+    if (credentials.username) {
+        payload.n = credentials.username;
+    }
+    return {
+        saslStart: 1,
+        autoAuthorize: 1,
+        mechanism: providers_1.AuthMechanism.MONGODB_OIDC,
+        payload: new bson_1.Binary(bson_1.BSON.serialize(payload))
+    };
+}
+/**
+ * Generate the saslContinue command document.
+ */
+function continueCommandDocument(token, conversationId) {
+    if (conversationId) {
+        return {
+            saslContinue: 1,
+            conversationId: conversationId,
+            payload: new bson_1.Binary(bson_1.BSON.serialize({ jwt: token }))
+        };
+    }
+    // saslContinue requires a conversationId in the command to be valid so in this
+    // case the server allows "step two" to actually be a saslStart with the token
+    // as the jwt since the use of the cached value has no correlating conversating
+    // on the particular connection.
+    return {
+        saslStart: 1,
+        mechanism: providers_1.AuthMechanism.MONGODB_OIDC,
+        payload: new bson_1.Binary(bson_1.BSON.serialize({ jwt: token }))
+    };
+}
+//# sourceMappingURL=callback_workflow.js.map

package/lib/cmap/auth/mongodb_oidc/callback_workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback_workflow.js","sourceRoot":"","sources":["../../../../src/cmap/auth/mongodb_oidc/callback_workflow.ts"],"names":[],"mappings":";;;AAAA,+BAAmD;AAEnD,0CAAyF;AACzF,0CAAoC;AAIpC,4CAA6C;AAC7C,2DAAsD;AAGtD,+BAA+B;AAC/B,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B;;;GAGG;AACH,MAAa,gBAAgB;IAG3B;;OAEG;IACH;QACE,IAAI,CAAC,KAAK,GAAG,IAAI,mCAAe,EAAE,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,OAAO,CACX,UAAsB,EACtB,WAA6B,EAC7B,cAAc,GAAG,KAAK;QAEtB,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QAEvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAC/B,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,EACpB,OAAO,IAAI,IAAI,EACf,OAAO,IAAI,IAAI,CAChB,CAAC;QACF,IAAI,KAAK,EAAE;YACT,oEAAoE;YACpE,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE;gBACtC,uDAAuD;gBACvD,IAAI;oBACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;oBACvF,OAAO,MAAM,CAAC;iBACf;gBAAC,OAAO,KAAK,EAAE;oBACd,uEAAuE;oBACvE,aAAa;oBACb,IAAI,CAAC,KAAK,CAAC,WAAW,CACpB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,OAAO,IAAI,IAAI,EACf,OAAO,IAAI,IAAI,CAChB,CAAC;oBACF,MAAM,KAAK,CAAC;iBACb;aACF;iBAAM;gBACL,2CAA2C;gBAC3C,IAAI,CAAC,KAAK,CAAC,WAAW,CACpB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,OAAO,IAAI,IAAI,EACf,OAAO,IAAI,IAAI,CAChB,CAAC;gBACF,kDAAkD;gBAClD,OAAO,IAAI,CAAC,gBAAgB,CAC1B,UAAU,EACV,WAAW,EACX,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,WAAW,CAClB,CAAC;aACH;SACF;aAAM;YACL,uDAAuD;YACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAC1C,IAAA,UAAE,EAAC,WAAW,CAAC,MAAM,CAAC,EACtB,oBAAoB,CAAC,WAAW,CAAC,EACjC,SAAS,CACV,CAAC;YACF,MAAM,OAAO,GAAG,WAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAA6B,CAAC;YACpF,6CAA6C;YAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;SACvF;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,gBAAgB,CAC5B,UAAsB,EACtB,WAA6B,EAC7B,aAAuC,EACvC,WAAmC,EACnC,cAAuB;QAEvB,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,4EAA4E;QAC5E,IAAI,OAAO,EAAE;YACX,MAAM,MAAM,GAA2B,MAAM,OAAO,CAClD,WAAW,CAAC,QAAQ,EACpB,aAAa,EACb,WAAW,EACX,UAAU,CACX,CAAC;YACF,uBAAuB;YACvB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;gBAClC,MAAM,IAAI,oCAA4B,CACpC,uEAAuE,CACxE,CAAC;aACH;YACD,wDAAwD;YACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CACjB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,OAAO,IAAI,IAAI,EACf,OAAO,EACP,MAAM,EACN,aAAa,CACd,CAAC;YACF,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;SACpE;aAAM;YACL,0CAA0C;YAC1C,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;SACtF;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,UAAsB,EACtB,WAA6B,EAC7B,aAAuC,EACvC,cAAuB;QAEvB,6BAA6B;QAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QACvE,yEAAyE;QACzE,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE;YACZ,oCAAoC;YACpC,MAAM,IAAI,iCAAyB,CACjC,6DAA6D,CAC9D,CAAC;SACH;QACD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC;QACnF,uBAAuB;QACvB,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;YAC5C,MAAM,IAAI,oCAA4B,CACpC,uEAAuE,CACxE,CAAC;SACH;QACD,wDAAwD;QACxD,IAAI,CAAC,KAAK,CAAC,QAAQ,CACjB,UAAU,CAAC,OAAO,EAClB,WAAW,CAAC,QAAQ,IAAI,EAAE,EAC1B,OAAO,EACP,OAAO,IAAI,IAAI,EACf,WAAW,EACX,aAAa,CACd,CAAC;QACF,OAAO,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IAC1E,CAAC;CACF;AAxLD,4CAwLC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CACvB,MAA8B,EAC9B,cAAkC,EAClC,UAAsB,EACtB,WAA6B;IAE7B,qCAAqC;IACrC,OAAO,UAAU,CAAC,YAAY,CAC5B,IAAA,UAAE,EAAC,WAAW,CAAC,MAAM,CAAC,EACtB,uBAAuB,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,EAC3D,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,WAA6B;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,WAAW,CAAC,QAAQ,EAAE;QACxB,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC;KAClC;IACD,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,yBAAa,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,KAAa,EAAE,cAAuB;IACrE,IAAI,cAAc,EAAE;QAClB,OAAO;YACL,YAAY,EAAE,CAAC;YACf,cAAc,EAAE,cAAc;YAC9B,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;SACpD,CAAC;KACH;IACD,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,gCAAgC;IAChC,OAAO;QACL,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,yBAAa,CAAC,YAAY;QACrC,OAAO,EAAE,IAAI,aAAM,CAAC,WAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/lib/cmap/auth/mongodb_oidc/service_workflow.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandDocument = exports.ServiceWorkflow = void 0;
+const bson_1 = require("bson");
+const utils_1 = require("../../../utils");
+const providers_1 = require("../providers");
+/**
+ * Common behaviour for OIDC device workflows.
+ * @internal
+ */
+class ServiceWorkflow {
+    /**
+     * Execute the workflow. Looks for AWS_WEB_IDENTITY_TOKEN_FILE in the environment
+     * and then attempts to read the token from that path.
+     */
+    async execute(connection, credentials) {
+        const token = await this.getToken();
+        const command = commandDocument(token);
+        return connection.commandAsync((0, utils_1.ns)(credentials.source), command, undefined);
+    }
+    /**
+     * Get the document to add for speculative authentication.
+     */
+    async speculativeAuth() {
+        const token = await this.getToken();
+        return { speculativeAuthenticate: commandDocument(token) };
+    }
+}
+exports.ServiceWorkflow = ServiceWorkflow;
+/**
+ * Create the saslStart command document.
+ */
+function commandDocument(token) {
+    return {
+        saslStart: 1,
+        mechanism: providers_1.AuthMechanism.MONGODB_OIDC,
+        payload: bson_1.BSON.serialize({ jwt: token })
+    };
+}
+exports.commandDocument = commandDocument;
+//# sourceMappingURL=service_workflow.js.map